Imagine waking up to find that your GitHub repository—the heart of your code—has been turned into a spy. You didn't notice any weird commits or broken builds, but in the background, a silent script was shipping your most sensitive cloud keys and API tokens straight to a hacker's inbox. This is the reality of the 'Gheist' and 'GhostAction' campaigns.
The Workflow Weapon
These aren't your typical phishing scams. Attackers are using stolen GitHub tokens to gain access to repositories and then planting malicious GitHub Actions workflows. Once these workflows are active, they act as automated 'secret-dumpers.'
GhostAction has already left a massive trail of destruction, compromising hundreds of repositories and exfiltrating thousands of secrets, including npm, PyPI, and DockerHub tokens. By hijacking the CI/CD pipeline, attackers can steal credentials the moment they are used in a build process.
Evolution of the Attack
The newer 'Gheist' campaign represents an attempt at scaled abuse. Unlike some traditional malware, Gheist doesn't rely on a central command-and-control (C2) server, making it harder to track. It simply targets every repository a stolen token can reach, attempting to automate the theft of secrets at scale.
While recent security improvements from GitHub have disrupted these efforts, the persistence of these campaigns shows a clear trend: the CI/CD pipeline is the new gold mine for credential hunters.
Staying Safe
To protect your projects, treat your GitHub tokens like your master password. Use the principle of least privilege, regularly audit your workflow files for unauthorized changes, and keep a close eye on your secret usage logs. In an era of automated theft, manual vigilance is your best defense.
Sources
Media
